# DF-4838 — amdgpu MMU-notifier invalidation entirely absent on DragonFly (latent)

## What this is
Not an exploitable PoC — an **absence proof**. The amdgpu userptr MMU-notifier
subsystem (amdgpu_mn.c) is "triple-dead" on DragonFly:

1. `CONFIG_MMU_NOTIFIER` is never defined (`sys/dev/drm/kconfig.h` has no such
   define), so `sys/dev/drm/amd/amdgpu/amdgpu_mn.h:37` always takes the `#else`
   stub branch: `amdgpu_mn_register()` → `-ENODEV`, `amdgpu_mn_get()` → `NULL`,
   `amdgpu_mn_lock/unlock()` → no-ops (amdgpu_mn.h:45-56).
2. `sys/dev/drm/amd/amdgpu/Makefile` does not list `amdgpu_mn.c` in `SRCS`
   (contrast `sys/dev/drm/radeon/Makefile:107` where `radeon_mn.c` is
   explicitly commented out) — the file is never compiled. It could not compile
   anyway: `__mmu_notifier_register` / `mmu_notifier_unregister_no_release`
   (amdgpu_mn.c:416/132) have no definition or declaration anywhere in `sys/`,
   and `amdgpu_mn_ops` (amdgpu_mn.c:356-367) initializes `.invalidate_range_end`,
   a member that does not exist in the shim's `struct mmu_notifier_ops`
   (sys/dev/drm/include/linux/mmu_notifier.h:40-46), and assigns 5-arg
   `int`-returning handlers to 4-arg `void` slots.
3. `amdgpu_gem_userptr_ioctl()` (amdgpu_gem.c:285-290) unconditionally
   `kprintf(...); return -EINVAL;` with the whole implementation `#if 0`-ed —
   no userptr BO can ever be created, so there is nothing to invalidate.

Consequence as shipped: **no reachable impact** (verified on the guest binary:
`/boot/kernel/amdgpu.ko` contains zero `amdgpu_mn` symbols and the
"not implemented" stub string). Latent hazard: if the file is ever wired into
the build and the shim "completed" as a no-op register (the pattern of DF-4819,
the dead shrinker), a writable GPU userptr would keep DMA-ing into revoked
user pages after munmap/madvise/exit — plus the DFly copy stripped upstream's
`struct amdgpu_mn.kref`, so the hash-hit path (amdgpu_mn.c:397-399) returns
shared state with no refcount and lifetime hangs solely on the mm-release
callback — a UAF the day the code goes live.

## Reproduce
- Host static proof: `sh findings/poc/DF-4838/static_check.sh`
- Guest binary proof (output saved in `run.log`):
  `vm.sh run_root 'nm /boot/kernel/amdgpu.ko | grep -c amdgpu_mn; strings /boot/kernel/amdgpu.ko | grep userptr'`

## Expected
- `0` amdgpu_mn symbols in the shipped module; kconfig grep count `0`;
  Makefile grep no match; stub string present in the binary.